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Abstract. In this paper, the relation between binomial Niho bent functions 
discovered by Dobbertin et al. and o-polynomials that give rise to the Subiaco 
and Adelaide classes of hyperovals is found. This allows to expand the class 
of bent functions that corresponds to Subiaco hyperovals, in the case when 
in = 2 (mod 4). 



1. Introduction and Preliminaries 

Boolean functions of n variables are binary functions over the Galois field F2™ 
(or over the vector space F£ of all binary vectors of length n). In this paper, we 
shall always endow this vector space with the structure of a field, thanks to the 
choice of a basis of F2« over F2 . Boolean functions are used in the pseudo-random 
generators of stream ciphers and play a central role in their security. 

Bent functions were introduced by Rothaus |10j in 1976. These are Boolean 
functions of an even number of variables n, that are maximally nonlinear in the 
sense that their Walsh transform takes precisely the values ±2™/ 2 . This corre- 
sponds to the fact that their Hamming distance to all afline functions is optimal. 
Bent functions have also attracted a lot of research interest because of their relations 
to coding theory and applications in cryptography. Despite their simple and natu- 
ral definition, bent functions turned out to admit a very complicated structure in 
general. On the other hand, many special explicit constructions are known. Distin- 
guished are primary constructions giving bent functions from scratch and secondary 
ones building new bent functions from one or several given bent functions. These 
constructions often look simpler when written in their bivariate representation but, 
of course, they also have an equivalent univariate form (see Subsection II. 1|) . 

It is well known that some of the explicit constructions belong to the two 
general families of bent functions which are the original Maiorana-McFarland [8] 
and the Partial Spreads classes. It was in the early seventies when Dillon in his 
thesis [5] introduced the two above mentioned classes plus the third one denoted 
by H, where bentness is proven under some conditions which were not obvious to 
achieve (in this class, Dillon was able to exhibit only those functions belonging, 
up to the affine equivalence, to the Maiorana-McFarland class). He defined the 
functions in class H in their bivariate representation but they can also be seen in 
the univariate form as found recently by Carlet and Mesnager j2]. They extended 
the class H to a slightly larger class denoted by % (see Subsection ll.2[) . also defined 
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in bivariato representation, and observed that this class contains all bent functions 
of the, so called, Niho type which were introduced in [6] by Dobbertin et al. (see 
Subsection ll.3l) . 

1.1. Trace representation, Boolean functions in univariate and bi- 
variate forms. For any positive integer k and any r dividing fc, the trace function 
Tr;() is the mapping from ¥ 2 k to F 2 >- defined by 

£-1 

Tr^(x) := ^ x 2 " = x + x 2 ' + x 2 ^ H h x 2 ^" . 

i=0 

In particular, the absolute trace over F 2 fc is the function Tr^ (x) = X^iLo 1 x<1 ■ R- ecau 
that the trace function satisfies the transitivity property Tr^ = Tr^ o Tr^. From 
now on assume n is even and n = 2m. For any set E, denote E \ {0} by E* . 

The univariate representation of a Boolean function is defined as follows: we 
identify F 2 (the n-dimensional vector space over F 2 ) with F 2 » and consider the 
arguments of / as elements in F 2 >« . An inner product in F 2 ™ isx-y — Tr"(a;y). There 
exists a unique univariate polynomial X)i=o 1 aiX% over ^2™ that represents / (this is 
true for any vectorial function from F 2 ™ to itself). The algebraic degree of / is equal 
to the maximum 2- weight of an exponent having nonzero coefficient, where the 2- 
weight w 2 (i) of an integer i is the number of ones in its binary expansion. Hence, 
in the case of a bent function, all exponents i whose 2-weight is larger than m have 
a zero coefficient a^. Moreover, / being Boolean, its univariate representation can 
be written in the form of f(x) = J2jer T^i ( a j x ^)> where T n is the set of integers 
obtained by choosing one element in each cyclotomic coset of 2 modulo 2™ — 1, o(j) 
is the size of the cyclotomic coset containing j and aj e F 2 oU) . This representation 
is unique up to the choice of cyclotomic coset representatives. Function / can also 
be written in a non-unique way as Tr"(P(x)) where P(x) is a polynomial over F 2 ™. 

The bivariate representation of a Boolean function is defined as follows: we iden- 
tify F 2 n with F 2 m x F 2 ™ and consider the argument of / as an ordered pair (x, y) of 
elements in F 2 ™ . There exists a unique bivariate polynomial ^2 0<i j<2 m -i a i,j x% V 3 
over F 2m that represents /. The algebraic degree of / is equal to 

max (w 2 (i) + w 2 (j)) ■ 

OJ) I Qi,j#o 

And / being Boolean, its bivariate representation can be written in the form of 
f(x,y) = Tr™(P(x,y)), where P(x,y) is some polynomial of two variables over 

F 2 m. 

Let / be an n- variable Boolean function. Its "sign" function is the integer- 
valued function Xf '■= ( — 1) • The Walsh transform of / is the discrete Fourier 
transform of Xf whose value at point w € F 2 n is defined by 

x/M = £ (-i)'« +T *<-> • 

Definition 1.1. For even n, a Boolean function / in n variables is said to be 
bent if for any w S F 2 n we have Xf( w ) = i2f. 



NIHO BENT FUNCTIONS AND SUBIACO/ADELAIDE HYPEROVALS 



3 



1.2. Class T-L of Bent Functions. In his thesis [5], Dillon introduced the 
class of bent functions denoted by H . The functions in this class are defined in 
their bivariate form as 

f(x,y)=Tr?(y + xG(yx 2 ' n - 2 )) , 

where x, y € Fa"» and G is a permutation of F2*™ such that G(x) + x does not 
vanish and for any /3 £ FjjU, the function G(x) + fix is 2-to-l (i.e., the pre-image 
of any element of ¥2^ is either a pair or the empty set). As observed by Car let 
and Mesnager [2, Proposition 1], this class can be slightly extended into a class W 
defined as the set of (bent) functions g satisfying 

[ > 9{X,V) \Tr™( M y), if x = , 

where /1 £ ¥2™ and H is a mapping from ¥2™ to itself satisfying the following 
necessary and sufficient conditions 

(1.2) G : z i-> H(z) + fiz is a permutation on ¥2™ 

(1.3) 2 i-> G(z) + f3z is 2-to-l on F 2 ™ for any /3 e . 

As proved in [2j Lemma 13], condition f|l .3[) implies condition (|1.2jl and, thus, is 
necessary and sufficient for g being bent. It also follows that polynomials G(z) 
satisfying ()1.3[) are so-called o-polynomials (oval polynomials) over ¥2^ (the addi- 
tional properties of G(0) = and G(l) = 1 can be achieved by taking §|ffe§rmj 
instead of G(z)). o-polynomials arise from hyperovals and define them. Note that 
class H contains all bent functions with the property that their restriction to the 
multiplicative cosets of F2" is linear. 



1.3. Niho bent functions. Recall that a positive integer d (always under- 
stood modulo 2™ — 1) is said to be a Niho exponent and t \— > t d is a Niho power 
function if the restriction of t d to F2™ (and, therefore, to its cosets uF2"») is linear 
or, in other words, d = 2 J (mod 2 m — 1) for some j < n. As we consider Tr"(a£ d ) 
with a € F21, without loss of generality, we can assume that d is in the normalized 
form, i.e., with j = 0. Then we have a unique representation d = (2 m — l)s + 1 
with 2 < s < 2 m . The simplest example of an infinite class of Niho bent functions 
is the quadratic function Tr™(crf 2 +1 ) with a € F^™. Other known classes are: 

• Three examples from [6] are binomials of the form f(t) = Tr™(ai£ dl + 
a 2 t d2 ), where 2d x = 2 m + 1 e Z/(2™ - 1)Z and a u a 2 e ¥* n are such that 
(a 1 + af" ) 2 = a\ + . Equivalently, denoting a = (ot\ + a 2m ) 2 and b = ct2 
we have a = b 2 ™ +1 e F* m and f(t) = Tr? (at 2 ™ +1 ) + Tr^(6t d2 ). Note that 
if b = and o^O then / is also bent but becomes quadratic equal to the 
function mentioned above. The possible values of c? 2 are: 

d 2 = (2 m -1)3+1 (with the condition that, if m = 2 (mod 4) then 
b is the fifth power of an element in F 2 n ; otherwise, b can be any 
nonzero element), 

4d 2 = (2 m — 1) + 4 (with the condition that m is odd), 
6g?2 = (2 m — 1) + 6 (with the condition that m is even). 

As observed in [6l [l], these functions have algebraic degree m, 3 and m 

respectively. 
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An extension by Leander and Kholosha 7] of the second class from [6] 
has the form of 



-l 



(1.4) Tr™( a t 2 '" +1 + J2 t (2m - 1)5V+1 ) 

i—1 

with r > 1 satisfying gcd(r, m) = 1 and a e F2» is such that a + a 2 '™ = 1. 
• Functions in a bivariate form obtained from the known o-polynomials (see 
[2j Section 6]). 

As was noted in [6], all cases except for di = (2 m — 1)3 + 1 with m = 2 ( mod 4) give 
gcd(c?2, 2™ — 1) = 1 and in the remaining case, gcd(G?2, 2 n — 1) = 5. Therefore, having 
the condition on b, it can be assumed, without loss of generality, that 6=1 (this is 
achieved by substituting t with fe _1 / d2 i). However, in Subsection 13.21 we show that 
even in the case when m = 2 (mod 4) the value of b can be taken arbitrary under 
the condition that a = b 2 +1 . 

Since the restriction to tiF 2 m of these bent functions is linear, they all belong 
to H. The question left open in [6] was finding the dual and checking if that was 
of the Niho type (possibly up to affine equivalence) . In [2l [1] considered were bent 
functions from the second class (having degree 3) and multinomial (jl.4|) . It was 
shown that corresponding o-polynomials are Frobenius mappings and dual functions 
were found that turned out not to be in the Niho class. Moreover, these cases 
give bent functions in the completed Maiorana-McFarland class. In this paper, we 
find o-polynomials that arise from the first class of binomial Niho bent functions. 
However, it still remains to determine the dual. 

2. Subiaco Hyperovals 

Here we define o-polynomials that give rise to the Subiaco family of hyperovals. 

Theorem 2.1 (Theorems 3-5 [4]). Take polynomials f(x) and g(x) and for any 
s € F2™ define 

f{x) + esg(x) + ^/V/ 2 
{lA) Is{X) ~ 1 + es + aV* 

where e € F2™ with Tr™(e) — 1 is defined further. Then in the following cases, 
g(x) and f s (x) are o-polynomials: 

(i) if m is odd then take e = 1 and 

x 2 + x 1 . x A + x 3 1 

(x A + x + ly (x z + x + \y 

(ii) if m = 2 (mod 4) then take e = w G F2™ with w 2 + w + 1 = and 

X 2 (x 2 +WX + w) , 1 . . WX(X 2 +X + W 2 ) , 1 

/ [x) = -7-5- TTvT +wx2 and 9( x ) — ~T^T~i _l i\2 +w x2 ' 

(x A + wx + \y yx z + wx + \y 

(iii) for any m, take e = ^^J^ where w S F2"> with w 2 + w + 1^0 and 
Tr"(l/w) = 1, and 

,. . w 2 (x 4 +x)+w 2 (l + w + w 2 ){x 3 +x 2 ) 1 

f( X ) = — ( 2I ^ 1A2 L+X2 md 

[x + wx + ly 

w 4 x 4 + w 3 (l + w 2 + w 4 )x 3 + w 3 (l + w 2 )x w 1 / 2 1 



9{x) 



(w 2 + w 5 + w 1 / 2 )(x 2 + wx + l) 2 w 2 + w 5 + w 1 / 2 
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It is useful to have the following explicit expressions for f s (x) in each of the 
cases considered. Denote 1 + es + s= = A, then f s {x) is equal to 

s(x 4 + X 3 ) + x 2 + X 1 

2.2 V - „ ' A .T +X2 , to odd 
v ' A(x 2 +x + l) 2 



_ 1 fx* + w(sw + l)(x 3 + X 2 ) + swx 
(x 2 + wx + l) 2 



(2.3) A^ 1 ^ + (w 2 +s + si)x2 ) , m/2 odd 



,„ iS / 9 (1 + su; + w 2 )x 4 + (1 + u; + u> 2 ) 2 (s:z; 3 + x 2 ) + (s + w + sw 2 )x 
2 - 4 ™ " tt^ 9T7V 7^ — 

+ | s* H 1 ,„ . + 1 57- ) xM (e + es + s^) _1 , m arbitrary , 

\ w L ' z (1 + w + w A ) ) ) 

where in (|2.4|) . we changed s + 1 for s in the original definition of f s (x). Note that 
for m odd, taking w = 1 in (|2.4[) results in (|2.2j) . 

In each of the cases listed above, the set (f(x),g(x),a) defines a q-clan. On 
the other hand, by 4, Theorem 1], the existence of the g-clan is equivalent to the 
property that g(x) is an o-polynomial and f s (x) is an o-polynomial for any s £ 
F 2 m . In [9] , it was shown that the Subiaco construction provides two inequivalent 
hyperovals if m = 2 (mod 4) and one hyperoval otherwise. 

3. Bent Functions from Subiaco Hyperovals 

Take the following function over F 2 ™ 

f(t) = Tr" 1 l (at 2m+1 ) + T>y(&t 3 < 2m - 1 > +1 ) , 

where a £ F 2m and b £ F 2 „ are such that b 2m+1 = a. Let (it, v) be a basis of F 2 ™ 
as a two-dimensional vector space over F 2 m . Then for any x,y £ F 2 ™ , we obtain 
f(ux + vy) having the form of with 

ff(z) = J(u + vz)^ +Tr™ ^(u + uz) 3 * 2 "- 1 ^ 1 ) 

/i = fl ^ 2! ^ i + TC(6« 3(2m - 1)+1 ) . 
Here all notation are from Subsection 11.21 Therefore, with z £ F 2 m , 

G{z) = a^v^z + a^u + vz)^ +Tr^(b{v 3{2m - 1)+1 z+(u + vz) 3(2m -^ +1 )) . 
Further, we have that 

(u + vz)^~ = u~^~ + (Tr^(w 2 t))) 2 z2 
and since z £ F 2 ™, 

(3.1) a'jj^z + a^(u + vz)^ 1 = a^tT^ 1 + (Tr^u 2 ™ v)) 1 z^ . 

Now expand the term (u + wz) 3(2 " 1_1)+1 . To this end, note that 3(2™ - 1) + 1 = 
2 m+i _ 1 + 2™ - 1. Then 

(u + vz) 3 ^ m -^ +1 = (u + vzf m+1 - l {u + vzf m - 1 

2 m+l_ 1 2 m -l 

= u 2m+1-1-i W u 2m - l - j {vzy 

j=0 j=0 
3-2 m -2 

= ™d 2)u 3 - 2m - 2 - 1 (vzf , 

i=0 
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where N — \Ei\ and 

Ei = {{31,32) I 3i+32 = i, < ji < 2 m+1 -l,0<j 2 < 2 m - 1} . 

We compute N by enumerating the elements of Ei as follows: 

• for < i < 2 m - 1, we have E, = {(i - j, 3) | < j <i} and Ni = % + 1; 

• for 2 m < i < 2 m+1 - 1, we have E 4 = {{i - 3,3) | < 3 < 2 m - 1} and 

Ni = 2 m ; 

• for 2 m+1 < i < 3 ■ 2 m - 2, we have E 4 = {{i - \ i - 2 m+1 + 1 < 
j < 2 rn — 1} and N = 3 ■ 2 rn — 1 — i (indeed, ji +32 = i implies that 
h=i-ji>i- 2 m+1 + 1 since j x < 2 m+1 - 1). 

Therefore iV» mod 2 = 1 if and only if i = 21 with < I < 2 m ~ x - 1 or 
i = 2 m+1 + 21 with < I < 2 m - 1 - 1 and 

2 m-l_ 1 2 m-l_ 1 



( u + ^) 3 ( 2m - 1 )+i= u 3 - 2m - 2 - 2 \vz) 21 + u 3 - 2 ™- 2 - 2 ™ + - 2l (vz) 

1=0 1=0 

y 2 £ 1 u ^-2{l + l) {vz) 2l ^ 1 U 2m - 2 ^V 2m+1 - 2 (vz) 2 ^ 

1=0 1=0 

= 2 Y, 1 u 3 - 2m -^ l+1 \vz) 21 + 2 J2 u 2m ~ 2l v 2m+1 ~ 2 (vz) 



u, v z {yz^ li 

1=0 1=1 



2" 



z 
1=1 

-1„,^2" 



,,3-2" -2 . 



1=1 

u 3.2»-a + (u 2(2--l) + w a(2»-l) ) f j + 1 + (g^l j ( , • - - : 

\ 1 + u l v l z l 

= w 2 m w 2(2--l) + u 2« (u a(2«-l) + V 2(2™-1) )(1 + „-l vz )2«-2 + ^3-2™ -2 z 

= u 2m v 2 V m -V + u 2 (u 2 ( 2m -V + «»P"-i))( u + ^) 2 '"- 2 + w 3 - 2 '"- 2 z . 

In the second sum after (*), we used that z 2 + +2[ = (z 2 ) 2 z 21 = z 2 z 21 = z 2 ( l+1 \ 
Finally, denoting 

c = Ju 2 ^ + Trl(bu 2m v 2 V m -V) 

and using (|3.1[) . we obtain that 
(3.2) 

G{z) =c + ai (K( U 2 %))^5 + Tr n m (bu 2 {u 2{2m -^ + v^'^u + vzf m ~ 2 ) . 

Now assume v = 1 and take it G F 2 ™ \ {1} with u 2 +1 = 1 that means u G 
F 2 « \ F 2 m. Also denote u + m 2 ™ = w G F 2m and observe that Tr™(l/w) = 1 (since 
this is equivalent to u 2 + wu + 1 being irreducible over F 2 m ) . Moreover, all w G F 2 m 
with such a trace property are obtained in this way from u. Then u 2 _1 = w/u + 1 
and 

Ti n m {u 2m v)=w 



1 a („ a < 2m - 1 >+tt a ( am - 1 )) = 



«, 2 
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Under these conditions, c = a 2 + TrJ^(6u 2 ) and 
(3.3) 



G(z) — c+ (awz)i + 



1 bw 2 (u 2 + z) b 2 w 2 (u + z) 



(u + z) 2 (u 2m + z) 2 



,1 2 b(u + w + z) 3 + b 2 (u + z) 3 
v ' (u + z) 2 (u + w + z) 2 

,1 9 (b + b 2m )(u + z) 3 + bwiz 2 + wz + u 2m+1 + w 2 ) 
v ' (z 2 + wz + u 2 + 1 ) 2 

S3 , . .1 

= c + yawz) 2 

w 2 (b + b 2m )(z 3 + uz 2 + u 2 z) + bw 3 (z 2 + wz) + Tr™ (6 2 ™(u 5 + u)) 
+ (z 2 + wz + l) 2 

= + Tr™ (& 2 "*u 5 ) + (awz)5 

w 2 (b + b 2, ")(z 3 + uz 2 + u 2 z) + bw 3 (z 2 + wz) + Tr^(6 2m (u 5 + u))(z 2 + wz) 2 
+ (z 2 + wz + l) 2 

TC(fr 2 "V + u))z 4 + TC(% 2 z 3 + Trl l n (b 2m u 5 )w 2 z 2 + K(t r (u 4 + l))z 

(.z 2 + wz + l) 2 
Here we used the following identities 

(3.4) w 2 (b + b 2m )u 3 + bw 3 (l + w 2 ) = Trl l (b 2m (u 5 + u)) ; 

(3.5) u{b + b 2m ) + bw + Tr n m {b 2m {u"' +u)) = Tr^b 2 ™ u 5 ) ; 

(3.6) w 2 {b + b 2m )u 2 + bw 4 = Tr^b 2 ™ (u 4 + 1)) . 
Further, we consider three separate cases defined by the value of m. 

3.1. m odd. In this case, take u G F4 \ {0, 1}. Note that u G ¥2^ \ ¥2™ and 
w = u + u 2 " 1 = u + u 2 = 1. Then, by $M > 

Tr n m (b)(z 4 + z 3 ) + TC(bu)(z 2 + z) 



G{z) = a? +Tr™ (bu) + (az) 2 + 



(z 2 + z + l) 2 



1 , . .1 i(B + B- 1 )(z 4 + z 3 ) + {B- 1 u 2 + Bu)(z 2 + z) 
« 2 +TC(H + (az) 2 +ai y - ^ 2 y V ^ * 



(z 2 + ^+l) 2 

= a*+n£(&u) + a*/.(*) , 

where B = ba~^ with B^ 1 = b 2 = B 2 since a = b 2 +1 . Polynomial / s (.z) 

with s = tt l^g2 M G F2W. is an o-polynomial (I2.2[) (assuming u 2 + _B 2 u ^ 0). In the 
case when u 2 = B 2 u (or, equivalently, 6 2 " 1-1 = u 2 ) we obtain 

1 z 4 + z 3 

G(z) =bu + buz? + bu—r, — - = bu(l + g(z)) , 

[z l + z + \y 

since a 2 = (b 2 + 1 ) 2 = bu = b + b 2 and where o-polynomial g(z) comes from 
Theorem O Item ©. 

Assuming b 2 _1 7^ u 2 , note that equation s = ^m,!^ can be solved for 
the unknown b G for any s G F2»» since s 7^ u. We conclude that the set of 
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bent functions with b € F 2 „ corresponds exactly to all o-polynomials described in 
Theorem 12.11 Item {jj . This means that the existence of this set of bent functions 
is equivalent to the existence of the corresponding g-clan. 

3.2. m = 2 (mod 4). In this case, take u 6 Fi6 \ F4 with u 5 = 1. Note that 
u e F 2 n \ F 2m and u 2 '" +1 = u 5 = 1. Then u + u 2 " 1 = u + 11 4 = 111 e F 4 C F 2 m. 
Obviously, ic^O. It can be checked directly that u with the prescribed properties 
also satisfies ai/l and, thus, w 2 + w = 1. There are /owr options for choosing u 
with these properties and both w £ F4 \ {0, 1} can be obtained. Then, by (I3.3[) . 

G(z) = a* +Tr^(6) + («wz)5 

| TC(fr(^ + l))z 4 + TC(frK(z 3 + ^ 2 ) + Tr^Ma + l))z 

(z 2 + l) 2 

= « 2 +Tr « 6 + a«;z > + Tr^ 6 u 4 + 1 v yv ; 

(2^ + 1)^ 

( = } J + Tr» (6) + (1 + ws + s^Mu* + Ws(z) , 

where polynomial f s {z) with s = W j^^^i^iy^ is an o-polynomial (|2.3I) (assuming 
Tr™ (6(u 4 + 1)) ^ 0). In the case when Tr™ (6(u 4 + 1)) = (or, equivalently, 
b 2 _1 = (u + l) 3 = u A ) we obtain 

TC(6V 2 (z 3 + z 2 )+TC(6( U + l))z 



G(z) =a5 +Tr™ (6) + (awzY- 



(z 2 + wz ■ 



= ft- 



Trl(b) + bu 2 w 2 zi+bu 2WZ{z2 + Z + w2) 



(z 2 



a* +TY n m {b) + bu 2 g{z) 



since a = b 2 +1 — b 2 u 4 and Tr^(6)u; = 6(1 + u 4 )(u + u 4 ) = bu 2 and where o- 
polynomial g(z) comes from Theorem 12 . 1 1 Item (Jn|). On the other hand, if 6 2 " 1 " 1 = 
u 4 then it suffices just to take another u with the above defined properties (recall 
that four options exist). To obtain (*) we used the following identities 

( W + S 2 +.s)TC(6( U 4 + l)) 2 

= wTtIMu 4 + I)) 2 + vflr»(b(u + l)) 2 + w 2 Tr" m (b(u + l))Tr n m (b(u 4 + 1)) 

= w 2 (Tr n m (bu)Tr n m (bu 4 ) + TC(6)TC(6( U 4 + «)) + TC(6) 2 ) + uTEr™ (6(« 4 + u)) 2 

= w 2 {bu + b 2m u 4 )(bu 4 + b 2m u) + w 2 Tr™ (b) 2 = aw . 

It is important to observe that there are no restrictions on the value of b here. It 
means that this technique allows to enlarge the original class of Niho bent functions 
proved in [6]. 

Assuming b 2 _1 ^ it 4 , note that equation s = ^^^(„4^ L )]' > can be solved for 
the unknown b € F 2 „ for any s G F 2 m . Indeed, this equation can be rewritten as 

b(u 4 s + s + tim 2 + w 2 ) — b 2 (us + s + u 4 w 2 + w 2 ) or 

6(u 4 s + s + u 4 + u 2 ) = 6 2 '" (us + s + u 3 + u) . 

Since s e F 2 >™ , it is easy to see that this equation has nonzero sides and its right- 
hand side is a 2 m th power of the left-hand side. We conclude that the set of 
bent functions with b 6 F 2 „ corresponds exactly to all o-polynomials described in 
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Theorem 12.11 Item (juj). This means that the existence of this set of bent functions 
is equivalent to the existence of the corresponding g-clan. 

3.3. m = (mod 4). In this case, w 2 + w + 1 ^ since the opposite is 
equivalent to u 4 + u 3 + u 2 + u + 1 = that gives u £ F 2 4 which is a contradiction 
because F 2 4 C F 2 ™ . As was noted in Subsection 11.31 without loss of generality, we 
can assume b — a = 1. Then, by (|3.3|) . 



G(z) = 1 + Tr™ („«) + {v , x) h + ^(» 6 +^ + ^(^)^ + ^( U ^ 

(z^ + wz + 1)^ 

(*) , , rrvn / 5^ , / ,1 (w 5 +w 3 )z 4 + w 3 (l + w + w 2 ) 2 z 2 +m 4 z 

= 1 + Tr m (ir ) + 2 H — 

mV ' y ' (z 2 + wz + l) 2 

= 1 + Tr™ (u 5 ) + (w 2 + w 5 + wi)f (z) , 

where (*) follows by w(l + w + w 2 ) 2 = Tr^(w 5 ) and fo{z) is an o-polynomial from 
(ED). 

4. Bent Functions from Adelaide Hyperovals 

Here we define o-polynomials that give rise to the Adelaide family of hyperovals. 

Theorem 4.1 (Theorem 3.1 [3]). Assume m is even, n = 2m and denote 
I = 2 3 -1 . Take any (3 £ F 2 n \ {1} with j3 2 +1 = 1 and define the following 
functions over F 2 m 

Tr"^)(. + 1) TC^. + r 1 )') j md 

H) ~ T&W + TC(/3)(x + TC(/3)xV2 + iy-i +a; 

51 J TC(/3) ^TC^TC^O^ + TC^x^ + iy-i+Tr^^) ' 

where e = ^y^jTjj + lyrrgn + 1- 2%en and / s (ai) (defined in 12.1]) ) are o- 
polynomials for any s £ F 2 m . 

In particular, using that /3 2 " 1 = fJ^ 1 we obtain that 

Tr™ (fa; -I- fl 2 ")'") 
(x + Tr m (/5)a; i /" : + l) 1 1 
For even m, take the following Niho bent function over F 2 « 

/(*) = Tr?(at 2m+1 ) + T^ipt^-Vi* 1 ) , 

where | = 2 — is an inverse of 6 modulo 2 m + 1, a £ F 2 ,„ and b £ F 2 „ are such 
that b 2 +1 = a. As noted above, without loss of generality, it can be assumed that 
a = b = 1. 

Assume u = 1 and take u £ F 2 ™ \{1} with u 2 +1 = 1 that means u £ F 2 ™ \F 2 ™. 
Then (u, 1) is a basis of F 2 ™ as a two-dimensional vector space over F 2 m. Then for 
any x, y £ F 2 ™ , we obtain f(ux + vy) having the form of (jl.ip with 

H(z) = (z + u)^ + Tr^((z + u)( r " 1 H+ 1 ) 
M =l . 

Here all notation are from Subsection 11.21 
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Denote d = (2 m - 1)± + 1 = (2™- 1 + 1)/ + 1, where I = ^f^. Then 
2 m+1 d (mod 2" - 1) = (2 m+1 + 1)/ + 2 m+1 = (2 m + 1)(2Z + 1) + 21 

and 

TC((z+ M n=TC((z+ u r +id ) 

= (z + Jt )( r + 1 )( 2, + 1 )Tr:((z + )I ) 2i ) 
= (z 2 + TC( M )z + l) 2 ' +1 TC((z + U ) 2i ) 
TC((z + M ) 2 ') 
(z 2 + TC(u)z + l) i - 1 

since 3/ = 2 m - 1 and z 2 + Tr™ + 1 G F 2 ™. 
Therefore, with z 6 F 2 ™ and assuming u = /3 2 , 
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